CVE-2019-3773: Spring Web Services XML External Entity Injection (XXE)
Published Jan 14, 2019
·Updated
Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
Affected Software
5 affected components
Pivotal Software Spring Web Services<=2.4.3
Pivotal Software Spring Web Services>=3.0.0<=3.0.4
Oracle Financial Services Analytical Applications Infrastructure>=8.0.6<=8.1.0
Oracle FLEXCUBE Private Banking=12.0.0
Oracle FLEXCUBE Private Banking=12.1.0
Remediation
Patch Available
Patch Available
Event History
Jan 14, 2019
CVE Published
12:00 AM
Data Sourced
12:00 AM
RemedyDescriptionSeverityWeaknessAffected Software
Jan 18, 2019
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
DescriptionWeakness
Data Sourced
via NVD·10:29 PM
RemedyDescriptionSeverityWeaknessAffected Software
Jan 29, 2019
Data Sourced
via Red Hat·09:19 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is CVE-2019-3773?
CVE-2019-3773 is a vulnerability in Spring Web Services that allows for XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
2
Which versions of Spring Web Services are affected by CVE-2019-3773?
Versions 2.4.3, 3.0.4, and older unsupported versions of Spring Web Services are affected by CVE-2019-3773.
3
What is the severity of CVE-2019-3773?
The severity of CVE-2019-3773 is critical, with a severity value of 9.8.
4
How can I fix CVE-2019-3773?
To fix CVE-2019-3773, it is recommended to update to a supported version of Spring Web Services.
5
Where can I find more information about CVE-2019-3773?
You can find more information about CVE-2019-3773 at the following references: [link1], [link2], [link3].